Assume data-platform SSM role for /caterpillar/ secrets - #108
Open
prasadlohakpure wants to merge 2 commits into
Open
Assume data-platform SSM role for /caterpillar/ secrets#108prasadlohakpure wants to merge 2 commits into
prasadlohakpure wants to merge 2 commits into
Conversation
heimdall-task-role can assume heimdall-caterpillar-ssm-read, but GetParameter still ran in the Heimdall account. {{ secret }} now assumes that role before reading /caterpillar/* parameters.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Caterpillar’s config templating {{ secret "..." }} resolution to assume a cross-account SSM read role for /caterpillar/-scoped parameters, fixing failed secret lookups when running with Heimdall ECS task credentials.
Changes:
- Add path-based role selection (
/caterpillar/→ assumeheimdall-caterpillar-ssm-read) before reading SSM parameters. - Add a unit test covering the role-ARN selection logic.
- Promote AWS SDK modules (
credentials,sts) from indirect to direct dependencies.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| internal/pkg/config/secret.go | Adds path-gated STS AssumeRole credentials for /caterpillar/ secrets before SSM reads. |
| internal/pkg/config/secret_test.go | Tests the new path → role ARN mapping helper. |
| go.mod | Marks required AWS SDK modules as direct dependencies to support the new STS/assume-role usage. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+36
to
+40
| if roleARN := assumeRoleARN(path); roleARN != `` { | ||
| cfg.Credentials = aws.NewCredentialsCache( | ||
| stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), roleARN), | ||
| ) | ||
| } |
Comment on lines
+30
to
+40
| func getSecret(path string) (string, error) { | ||
| cfg, err := config.LoadDefaultConfig(ctx) | ||
| if err != nil { | ||
| return ``, err | ||
| } | ||
|
|
||
| if roleARN := assumeRoleARN(path); roleARN != `` { | ||
| cfg.Credentials = aws.NewCredentialsCache( | ||
| stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), roleARN), | ||
| ) | ||
| } |
Do not hardcode the role in Caterpillar. When CATERPILLAR_SSM_ASSUME_ROLE_ARN is set, assume it only for /caterpillar/ secrets; otherwise keep using the task role.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
heimdall-task-rolecan assumeheimdall-caterpillar-ssm-read, but ECS does not do that automatically. The Fargate task still runs asheimdall-task-rolein 122610511428; a cross-account role cannot be set astaskRoleArn.Caterpillar no longer hardcodes a role ARN. If the ECS task sets
CATERPILLAR_SSM_ASSUME_ROLE_ARN,{{ secret }}assumes it for/caterpillar/paths, thenGetParameter. Other secrets keep using the task role.Companion task-def env: https://github.com/patterninc/heimdall-config/pull/463
Types of changes
Checklist
Test plan
go test ./internal/pkg/config/github_org_members_daily